Privacy Policy

Data Privacy and Fair Processing Notice 

1st Shirley Scout Group, a Blythe District Scout Group

Our Privacy and Fair Processing Notice describes the categories of personal data we process and for what purposes.  We are committed to collecting and using such data fairly and in accordance with the requirements of the General Data Protection Regulation (GDPR).  This Notice should be read in conjunction with the Scout Association’s Data Protection Policy.

1. Who are we?  

We are 1st Shirley Scout Group, a youth charity.  Our mission is to actively engage and support young people in their personal development, empowering them to make a positive contribution to society.  We are incorporated by royal charter and are regulated as a member of the The Scout Association (see www.scouts.org.uk for more information).

1st Shirley Scout Group is part of Solihull Blythe Scout District.  1st Shirley Scout Group is registered as a charity with the UK Charity Commission.

The 1st Shirley Scout Group Executive Committee is the data controller for the information we collect from you for the purposes of membership, events, and activities.  Any personal data that we collect will only be in relation to the work we do with our members and through our relationship with supporters, donors, and funders.

2. Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data.  Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession.  The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).

How we gather personal information 

The majority of the personal information we hold, is provided to us directly by parents/legal guardians, Scout Leaders, or the members themselves (Beavers, Cubs, Scouts) in either paper form or via our online membership systems.  In the case of an adult member, data may also be provided by third party reference agencies, such as the Disclosure and Barring Service (DBS).

Photography

The names of individuals and their photographs will not be used in promotional material without the permission of the subjects of such photography.

3. Why do we collect data?

The data we collect in support of our activities and operation will include data that is Personal Data and Sensitive Personal Data.  The GDPR requires that there is a lawful basis to process personal data.  We collect under the following basis:

Legitimate Interest

We have a legitimate interest to process personal data and sensitive personal data in order to provide membership services and activities.

Membership Services 

Where someone has agreed to become a member of 1st Shirley Scout Group we will collect personal data from them in order to maintain membership records and to undertake vetting checks as required in law and by the Scout Association as a condition of membership.  The personal data items we collect can be found on the Adult Information Form for adults and in Appendix One for youth members.

The appointment of adults into roles in 1st Shirley Scout Group is organised and run by Solihull Scout County.  As part of the appointment process they may request references and will store that information ( see Solihull Scout County’s Data Privacy and Fair Processing Notice).

Activities 

Where we provide an activity, there is a requirement to ensure that we know who is on an activity and some details about them.  This will enable us to ensure that the correct amount of money is collected for an activity, to process any awards that may result from an activity, to be able to contact participants before, during and after an activity, and to be able to provide information to any third-parties as required in support of the activity or to respond to an emergency.  Additionally, there may be a need to store sensitive personal data about an individual’s health in order to ensure that suitable support can be given to them on an event.

We comply with our obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

 4. How we store personal data

We are committed to the protection of your personal information.

We generally store personal information in one of five secure digital online database systems, where access to that data is restricted and controlled.

• Compass is the online membership system of The Scout Association, this system is used for the collection and storage of Adult personal data.  The data processor for Compass is The Scout Association and their data processing notice is available here.

• Online Scout Manager is an online membership system run by Online Youth Manager Ltd, this is a secure membership database where we store the personal information of Adults and Youth members for the day to day running of 1st Shirley Scout Group.  The data processor for Online Scout Manager is Online Youth Manager Ltd. and their data processing notice is available here.

• Google Services.  Google Forms are used within 1st Shirley Scout Group in order to enable people to sign-up for activities and events.  Google Email (Gmail) services are used in support of the organisation and day-to-day running of the Unit.  Google Drive cloud storage is used in support of the organisation and day-to-day running of the Unit.  Google is the data processor for these services and their data processing notice is available here.

• Event data – Scouts EMS is an online event management company used by Solihull Blythe Scout District and Solihull Scout County. Scout Event Management is the data processor and their data processing notice is available here.

Where data is required to be held in an off-line system (e.g. a paper system on an event) we will ensure that there is suitable protection for the paper records and that paper records will be securely destroyed after an event (unless there is a requirement to maintain a paper record for a legal reason such as an injury on the event, in which case the paper record will be stored securely).

5. Sharing and transferring personal Information

We will share information with third parties when required.  Information is regularly shared with the following third-parties:

• Intrepid Explorer Scout Unit (ESU).  1st Shirley Scout Group and Intrepid ESU both use Online Scout Manager to store membership data. When young persons transfer from Scouts (sometime between the age of 13 ½  and 14 ½) to the Explorer Unit their membership record is transferred to Intrepid within Online Scout Manager.

• Other Explorer Scout Units or Scout Groups. Should a young person move from a 1st Shirley Scout Group section to another scout group or another explorer scout unit, other than Intrepid ESU, we will transfer their record to that scout group or explorer unit.

• Solihull Scout County.  Solihull Scout County organises events for all Scout Groups and Explorer Units in Solihull.  Where 1st Shirley Scout Group members participate in these events we share names and dates of birth with the organising team.  These are stored in the Scout Event Management System (EMS).

• The Chase Walk.  We share the names, addresses, and dates of birth of those undertaking the Chase Walk with their organising team.

• Strategy.  We share the names, addresses, dates of birth, and dietary requirements with those undertaking Strategy with their organising team.

• Youth Hostel Association.  We may share names and dates of birth with the Youth Hostel Association.

We will, however, share your personal information with others outside of 1st Shirley Scout Group where we need to meet or enforce a legal obligation; this may include The Scout Association and its insurance subsidiary “Unity”, local authority services and law enforcement. Where we need to share information, we will only share your personal information to the extent needed for those purposes.

We will never sell your personal information to any third party for the purposes of marketing. 

Your personal data will be treated as strictly confidential.  We will only share your data with third parties outside of the organisation where there is a legitimate reason to do so.  We will take steps to anonymise the data we provide (i.e. collective reporting on gender, ethnicity, age, etc.).  If identifiable data is to be shared we will seek your consent.

Automated decision making

1st Shirley Scout Group does not have any automated decision-making systems.

Transfers outside the UK

We will not transfer your personal information outside of the UK, with the exception where an event is taking place outside of the UK and it is necessary to provide personal information to comply with our legal obligations, although generally such an event will have its own data collection form which will be securely held and disposed of after the event.

6. How long do we keep your personal data?

We will retain your personal information, throughout the time you/your child(ren) are a members of 1st Shirley Scout Group.

We will retain names and dates of attendance of the group in perpetuity.  Where awards have been gained we will keep a record of name and the award in perpetuity unless requested to delete this data.

We will also keep any Gift Aid Claim information for the statutory 7 years as required by HMRC (which may be beyond age 21)

7. Your rights and your personal data

You have the right to object to how we process your personal information. You also have the right to access, correct, sometimes delete and restrict the personal information we use. In addition, you have a right to complain to us and to the data protection regulator.

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:

• The right to be informed – you have a right to know how your data will be used by 1st Shirley Scout Group

• The right to access your personal data – you can ask us to share with you the data we have about you

• The right to rectification – this just means you can update your data if it is inaccurate or if something is missing. Adult members can view and edit their own personal information directly on our online membership system Compass

• The right to erasure – this means that you have the right to request that we delete any personal data they have about you. There are some exceptions, for example, some information can be held for legal reasons

• The right to restrict processing – if you think there is something wrong with the data being held about you, or you are not sure if we are complying to rules, you can restrict any further use of your data until the problem is resolved

• The right to data portability – this means that if you ask us we will have to share your data with you in a way that can be read digitally – such as a pdf. This makes it easier to share information with others

• The right to object – you can object to the ways your data is being used. This should make it easier to avoid unwanted marketing communications and spam from third parties

• Rights in relation to automated decision making and profiling – this protects you in cases where decision are being made about you based entirely on automated processes rather than a human input.

Whether or not you exercise your new rights is up to you – the main thing to remember is that they’re there if you need them.

8. Further processing

If we wish to use your personal data for a new purpose, not covered by this Data Privacy and Fair Processing Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

9. Contact Details 

To exercise all relevant rights, queries of complaints please in the first instance contact our Data Protection lead Andrew Baynes at andrew.baynes@solihullscouts.org.uk 

New at:  December 2018

Next review: December 2019

Appendix One - OSM Data Mapping